MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6a9b388aec4a8a16d582f2d2746c48ce5eed92c17030d4d1ac94d4eb3e943b23. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6a9b388aec4a8a16d582f2d2746c48ce5eed92c17030d4d1ac94d4eb3e943b23
SHA3-384 hash: 388c6bb46a9d989dcdba2352678c1102cc75e760310a40d1f7824587fcdc17e0beb51c892acebacf4c3b6feb29ee6f12
SHA1 hash: a23a72c7f0b3effe027a5c8a7154a6aacf0cd7e3
MD5 hash: bb1fb99107d39a4a83ab36b3fb35a91d
humanhash: lima-utah-orange-quebec
File name:bins.sh
Download: download sample
Signature Mirai
Create hunting rule
File size:10'830 bytes
First seen:2024-08-21 15:12:21 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 96:YgcWDfcLTv7ws0WJxWJpWJ1JiJ+J4LDfxb3yeEIEEE4HXkLB5gCaV6yXL40qLKCK:qpYQPSG48WuaYQPSGX
TLSH T1EA22A0C9356451222CB4CE0E29B81894D40ABDC15CC8CE798DC839ED844EEFE79D9EAD
Reporter NDA0E
Tags:mirai sh

Intelligence

File Origin
# of uploads :
1
# of downloads :
89
Origin country :
NL NL
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66c60402b2a4681a72966e64
Tags:
n/a
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/66c6040098e036ebc636820c/reports/58cf73e3-1d5f-4ee8-8f7e-fb32b1eca25d/overview
Result
Verdict:
MALICIOUS
Score:
30%
Verdict:
Susipicious
File Type:
SCRIPT
Link:
https://malprob.io/report/6a9b388aec4a8a16d582f2d2746c48ce5eed92c17030d4d1ac94d4eb3e943b23
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6a9b388aec4a8a16d582f2d2746c48ce5eed92c17030d4d1ac94d4eb3e943b23/
Threat name:
Linux.Downloader.Generic
Create hunting rule
Status:
Suspicious
First seen:
2024-08-21 15:13:06 UTC
File Type:
Text (Shell)
AV detection:
4 of 38 (10.53%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nkntrcxmjkfbnvmc6ljhi3cizzpo3ewboaynjunmstkowpuuhmrq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm linux persistence
Link:
https://tria.ge/reports/240821-slq2aayfrm/
Behaviour
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
Creates/modifies Cron job
Enumerates running processes
Executes dropped EXE
Renames itself
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.31
Link:
https://yomi.yoroi.company/submissions/6a9b388aec4a8a16d582f2d2746c48ce5eed92c17030d4d1ac94d4eb3e943b23

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Linux_Shellscript_Downloader
Create hunting rule
Author:albertzsigovits
Description:Generic Approach to Shellscript downloaders

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh 6a9b388aec4a8a16d582f2d2746c48ce5eed92c17030d4d1ac94d4eb3e943b23

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3090349/

Comments